1. Public Key Distribution and X.509 Wade Trappe

2. Distribution of Public Keys • There are several techniques proposed for the distribution of public keys: • Public announcement • Publicly available directory • Public key authority • Public key certificates

3. Public Announcement • Idea: Each person can announce or broadcast their public key to the world. • Example: People attach their PGP or RSA keys at the end of their emails. • Weakness: • No authenticity: Anyone can forge such an announcement • User B could pretend to be User A, but really announce User B’s public key.

4. Public Directory Service • Idea: Have a public directory or “phone book” of public keys. This directory is under the control/maintenance of a trusted third party (e.g. the government). • Involves: • Authority maintains a directory of {name, PK} • Each user registers public key. Registration should involve authentication. • A user may replace or update keys. • Authority periodically publishes directory or updates to directory. • Participants can access directory through secure channel. • Weaknesses: • If private key of directory service is compromised, then opponent can pretend to be directory service. • Directory is a single point of failure.

5. Public Key Authority • Idea: More security is achieved if the authority has tighter control over who gets the keys. • Assumptions: • Central authority maintains a dynamic directory of public keys of all users. • Central authority only gives keys out based on requests. • Each user knows the public key of the authority. • Weaknesses: • Public Key Authority is a single point of failure. • User has to contact PK Authority, thus the PK Authority can be a bottleneck for service.

6. Step 4 Step 5 Step 1 Step 2 Step 3 Step 7 Step 6 Public Key Authority, protocol PK Auth B A 6. B Sends: EeA(N1||N2) 1. A Sends: {Request || Time1} 2. PK Auth: EdAuth[ eB|| {Request || Time1}] 7. A Sends: EeB(N2) 3. A Sends B: EeB(IDA||N1) 4 and 5. B does steps 1 and 2.

7. Public Key Certificates • Idea: Use certificates! Participants exchange keys without contacting a PK Authority in a way that is reliable. • Certificates contain: • A public key (created/verified by a certificate authority). • Other information. • Certificates are given to a participant using the authority’s private key. • A participant conveys its key information to another by transmitting its certificate. • Other parties can verify that the certificate was created/verified by the authority. • Weakness: • Requires secure time synchronization.

8. Securely give eB to CA CertB = EdAuth{Time2||IDB||eB} Give eA securely to CA CertA = EdAuth{Time1||IDA||eA} CertA Cert B Public Key Certificates, overview Cert Auth B A • Requirements: • Any participant can read a certificate to determine the name and public key of the certificate’s owner. • Any participant can verify that the certificate originated from the certificate authority and is not counterfeit. • Only the certificate authority can create and update certificates. • Any participant can verify the currency of the certificate.

9. X.509 PK Certificates • X.509 is a very commonly used public key certificate framework. • The certificate structure and authentication protocols are used in: • IP SEC • SSL • SET • X.509 Certificate Format: • Version 1/2/3 • Serial is unique within the CA • First and last time of validity Version Cert Serial # Algorithm & Parms Issuer Name Validity Time: Not before/after Subject Name PK Info: Algorithm, Parms, Key . . . Signature (w/ hash)

10. X.509 Certificate Chaining • Its not feasible to have one CA for a large group of users. • Suppose A knows CA X1, B knows CA X2. If A does not know X2’s PK then CertX2(B) is useless to A. • If X1 and X2 have certified each other then A can get B’s PK by: • A obtains CertX1(X2) • A obtains CertX2(B) • Because B has a trusted copy of X2’s PK, A can verify B’s certificate and get B’s PK. • Certificate Chain: • {CertX1(X2)|| CertX2(B)} • Procedure can be generalized to more levels. CertX1(X2) CertX2(X1) X1 X2 A B {CertX1(X2)|| CertX2(B)}